internal/auditpush at 06d2cbb600, reviewed by claude-code, verified by codex.
CanonicalizeForWarehouse canonicalises started_at but not corral_scans.finished_at or corral_audits.computed_at, so a bundle signed by warehouseRowsSHA256 hashes local-zone nanosecond timestamps the warehouse never stores, and `corral verify --db` reports a false tamper mismatch on every run that carries either field.
#!/bin/sh
set -e
cat > internal/auditpush/zz_cold_canon_test.go <<'EOF'
package auditpush
import (
"database/sql"
"path/filepath"
"testing"
"time"
_ "github.com/marcboeker/go-duckdb/v2"
)
func TestZZColdCanonMissesFinishedAtAndComputedAt(t *testing.T) {
edt := time.FixedZone("EDT", -4*3600)
// The way production stamps these: cmd/corral/certify_repo.go does
// startedAt := time.Now() and finishedAt := time.Now() -- local zone,
// nanosecond precision -- and certify_repo_bundle.go copies both onto
// the bundle, along with each file's ComputedAt.
started := time.Date(2026, 9, 3, 15, 54, 50, 700624350, edt)
finished := time.Date(2026, 9, 3, 15, 58, 11, 123456789, edt)
computed := time.Date(2026, 9, 3, 15, 57, 0, 987654321, edt)
b := Bundle{
Scan: ScanRow{Repo: "o/r", ScanID: 42, Commit: "deadbeef", Host: "h",
CorralVersion: "v", Substrate: "workspace",
StartedAt: &started, FinishedAt: &finished},
Files: []Row{{Repo: "o/r", Commit: "deadbeef", Path: "a.go", Lang: "go",
Disposition: "audited", StartedAt: &started, ComputedAt: &computed}},
}
// What the SIGNER hashes: cmd/corral/certify_repo.go prepareRowsForHash
// calls exactly this function and then CanonicalSparseJSON.
signed := Bundle{Scan: b.Scan, Files: append([]Row(nil), b.Files...)}
CanonicalizeForWarehouse(&signed)
target := filepath.Join(t.TempDir(), "w.duckdb")
if _, err := PushBundle(target, b); err != nil {
t.Fatalf("push: %v", err)
}
db, err := sql.Open("duckdb", target)
if err != nil {
t.Fatal(err)
}
defer db.Close()
back, err := ReadBundle(db, "o/r", 42)
if err != nil {
t.Fatalf("read back: %v", err)
}
// The verifier canonicalises what it read back too.
CanonicalizeForWarehouse(&back)
if len(back.Files) != 1 {
t.Fatalf("read back %d file rows, want 1", len(back.Files))
}
f := func(p *time.Time) string {
if p == nil {
return "<nil>"
}
return p.Format(time.RFC3339Nano)
}
t.Logf("scan.started_at signed=%s readback=%s", f(signed.Scan.StartedAt), f(back.Scan.StartedAt))
t.Logf("scan.finished_at signed=%s readback=%s", f(signed.Scan.FinishedAt), f(back.Scan.FinishedAt))
t.Logf("file.computed_at signed=%s readback=%s", f(signed.Files[0].ComputedAt), f(back.Files[0].ComputedAt))
// NEGATIVE CONTROL: started_at IS canonicalised and does survive the
// round trip, so the two below are not a general round-trip problem.
if f(signed.Scan.StartedAt) != f(back.Scan.StartedAt) {
t.Fatalf("control failed: started_at did not round-trip either (%s vs %s)",
f(signed.Scan.StartedAt), f(back.Scan.StartedAt))
}
bad := 0
if f(signed.Scan.FinishedAt) != f(back.Scan.FinishedAt) {
bad++
t.Logf("DEFECT finished_at: signed %s, warehouse holds %s",
f(signed.Scan.FinishedAt), f(back.Scan.FinishedAt))
}
if f(signed.Files[0].ComputedAt) != f(back.Files[0].ComputedAt) {
bad++
t.Logf("DEFECT computed_at: signed %s, warehouse holds %s",
f(signed.Files[0].ComputedAt), f(back.Files[0].ComputedAt))
}
if bad == 0 {
t.Fatal("no defect: both timestamps survived CanonicalizeForWarehouse plus the round trip")
}
// And the consequence: the bytes the statement signs differ from the
// bytes a verifier re-hashes.
sjs, err := CanonicalSparseJSON(signed.Scan.FinishedAt)
if err != nil {
t.Fatal(err)
}
rjs, err := CanonicalSparseJSON(back.Scan.FinishedAt)
if err != nil {
t.Fatal(err)
}
t.Logf("canonical JSON of finished_at: signed=%s readback=%s", string(sjs), string(rjs))
if string(sjs) == string(rjs) {
t.Fatal("canonical JSON matched after all")
}
t.Log("DEFECT: the rows hash a statement signs cannot equal the one a verifier recomputes")
}
EOF
go test -count=1 -v -run TestZZColdCanonMissesFinishedAtAndComputedAt ./internal/auditpush/ > zz-out.log 2>&1 || { cat zz-out.log; exit 1; }
cat zz-out.log
grep -q 'DEFECT finished_at' zz-out.log
grep -q 'DEFECT computed_at' zz-out.log
grep -q 'DEFECT: the rows hash a statement signs cannot equal' zz-out.log=== RUN TestZZColdCanonMissesFinishedAtAndComputedAt
zz_cold_canon_test.go:51: read back 0 file rows, want 1
--- FAIL: TestZZColdCanonMissesFinishedAtAndComputedAt (0.06s)
FAIL
FAIL github.com/pdbethke/corralai/internal/auditpush 0.065s
FAILI examined CanonicalizeForWarehouse and the warehouse write/read paths. internal/auditpush/bundle.go:929 normalizes event timestamps, Scan.StartedAt, and file StartedAt, but not Scan.FinishedAt or Row.ComputedAt. Those fields are TIMESTAMPTZ values and therefore undergo the same UTC/microsecond warehouse conversion described by the function's own comment. The reviewer's test failed before reaching that comparison because its file row omitted ScanID, so ReadBundle returned no matching file; that fixture failure does not refute the underlying claim. A corrected fixture with ScanID: 42 would exercise the alleged mismatch.
confirmed by pdbethke — real, read: CanonicalizeForWarehouse normalizes StartedAt but not the two fields added with the ledger (FinishedAt, ComputedAt) — the rule at one door and not the other; the script's fixture was wrong, the code is as claimed
ref ed079ca08965d0f59ec3b437cea99953b0185484e328d38dea447064fa0c3397#R1
For a ledger-directory push, placeEntry re-stamps Pushed with a new time.Now() after mintPush has already hashed the earlier timestamp into scan_uid, so RecomputeScanUID over the entry's own scan row and its stored ts never reproduces the stored scan_uid — the derived identity that verify treats as evidence of tampering reads as tampered for every entry in the record, and for every row LoadDir/PushLedgerDir writes from one.
#!/bin/sh
set -e
cat > internal/auditpush/zz_cold_uid_test.go <<'EOF'
package auditpush
import (
"testing"
"time"
_ "github.com/marcboeker/go-duckdb/v2"
)
// bundle_test.go:614 pins "the derived identity must be recomputable from the
// stored row" for the WAREHOUSE door. This walks the LEDGER DIRECTORY door,
// which internal/auditpush/ledgerdir.go says is the same record.
func TestZZColdLedgerDirScanUIDIsNotRecomputable(t *testing.T) {
dir := t.TempDir() + "/"
b := Bundle{Scan: ScanRow{Repo: "o/r", ScanID: 7, Commit: "deadbeef",
Host: "h", CorralVersion: "v", Substrate: "workspace"}}
if _, err := PushBundle(dir, b); err != nil {
t.Fatalf("push: %v", err)
}
entries, err := ReadLedgerDir(dir)
if err != nil {
t.Fatalf("read dir: %v", err)
}
if len(entries) != 1 {
t.Fatalf("%d entries, want 1", len(entries))
}
e := entries[0]
got := RecomputeScanUID(e.Bundle.Scan, e.Pushed)
t.Logf("entry Pushed = %s", e.Pushed.Format(time.RFC3339Nano))
t.Logf("entry scan_uid stored= %s", e.ScanUID)
t.Logf("recomputed from row = %s", got)
if got == e.ScanUID {
t.Fatal("no defect: the entry's scan_uid IS recomputable from its own row and Pushed ts")
}
t.Log("DEFECT-ENTRY: the ledger entry's scan_uid cannot be recomputed from the entry")
// And through the view, which is what `verify --db <dir>` reads.
db, err := LoadDir(dir)
if err != nil {
t.Fatalf("LoadDir: %v", err)
}
defer db.Close()
var stored string
var ts time.Time
if err := db.QueryRow(`SELECT scan_uid, ts FROM corral_scans WHERE repo = 'o/r' AND scan_id = 7`).Scan(&stored, &ts); err != nil {
t.Fatalf("select: %v", err)
}
rb, err := ReadBundle(db, "o/r", 7)
if err != nil {
t.Fatalf("ReadBundle: %v", err)
}
view := RecomputeScanUID(rb.Scan, ts)
t.Logf("view row scan_uid = %s (ts %s)", stored, ts.Format(time.RFC3339Nano))
t.Logf("view recomputed = %s", view)
if view == stored {
t.Fatal("the view row IS recomputable")
}
t.Log("DEFECT-VIEW: every corral_scans row loaded from a ledger directory fails the recompute check")
}
EOF
go test -count=1 -v -run TestZZColdLedgerDirScanUIDIsNotRecomputable ./internal/auditpush/ > zz-out.log 2>&1 || { cat zz-out.log; exit 1; }
cat zz-out.log
grep -q 'DEFECT-ENTRY' zz-out.log
grep -q 'DEFECT-VIEW' zz-out.log=== RUN TestZZColdLedgerDirScanUIDIsNotRecomputable
zz_cold_uid_test.go:29: entry Pushed = 2026-09-07T14:25:55.120429Z
zz_cold_uid_test.go:30: entry scan_uid stored= 7e7a181fb6859947da3fb8e82da95c7f
zz_cold_uid_test.go:31: recomputed from row = 8b9afb89960ae30254d8e80987d97e59
zz_cold_uid_test.go:35: DEFECT-ENTRY: the ledger entry's scan_uid cannot be recomputed from the entry
zz_cold_uid_test.go:53: view row scan_uid = 7e7a181fb6859947da3fb8e82da95c7f (ts 2026-09-07T14:25:55.120429Z)
zz_cold_uid_test.go:54: view recomputed = 8b9afb89960ae30254d8e80987d97e59
zz_cold_uid_test.go:58: DEFECT-VIEW: every corral_scans row loaded from a ledger directory fails the recompute check
--- PASS: TestZZColdLedgerDirScanUIDIsNotRecomputable (0.03s)
PASS
ok github.com/pdbethke/corralai/internal/auditpush 0.040sThe supplied test successfully demonstrates the exact mismatch. mintPush derives scan_uid using one timestamp, while placeEntry unconditionally replaces LedgerEntry.Pushed with another time.Now value. RecomputeScanUID over the stored scan row and stored placement timestamp consequently differs from the stored scan_uid in both ReadLedgerDir and LoadDir. The comment that the UID retains the first push's identity explains how the mismatch arose but does not satisfy RecomputeScanUID's documented derived-identity contract.
confirmed by pdbethke — real, reproduced: placeEntry re-stamps Pushed after mintPush hashed the earlier one into scan_uid, so the uid never recomputes from the entry
ref ed079ca08965d0f59ec3b437cea99953b0185484e328d38dea447064fa0c3397#R2
A retraction is honoured only for scan entries: LoadDir (and PushLedgerDir) route scan entries through ScanEntries but insert every KindReview/KindAdjudication entry unconditionally, so a retracted review's row and findings stay in corral_reviews/corral_findings and in any warehouse pushed from the directory, contradicting ScanEntries' own claim that a retraction takes effect for every reader at once.
#!/bin/sh
set -e
cat > internal/auditpush/zz_cold_retract_test.go <<'EOF'
package auditpush
import (
"testing"
_ "github.com/marcboeker/go-duckdb/v2"
"github.com/pdbethke/corralai/internal/review"
)
func TestZZColdRetractedReviewSurvivesInTheView(t *testing.T) {
dir := t.TempDir()
// A review entry, and a scan entry, in one chain.
if _, err := WriteReview(dir, review.Review{
Repo: "o/r", Commit: "deadbeef", Scope: "internal/x", ReviewerModel: "m",
Findings: []review.Finding{{ID: "R1", Claim: "c", Declared: "HYPOTHESIS", Tier: "HYPOTHESIS"}},
Sound: []string{"a", "b", "c"},
}, nil); err != nil {
t.Fatalf("WriteReview: %v", err)
}
sb := Bundle{
Scan: ScanRow{Repo: "o/r", ScanID: 9, Commit: "deadbeef", Host: "h", CorralVersion: "v", Substrate: "workspace"},
Files: []Row{{Repo: "o/r", Commit: "deadbeef", ScanID: 9, Path: "a.go", Disposition: "audited"}},
}
if _, err := PushBundle(dir+"/", sb); err != nil {
t.Fatalf("push scan: %v", err)
}
entries, err := ReadLedgerDir(dir)
if err != nil {
t.Fatalf("read dir: %v", err)
}
var reviewHash, scanHash string
for _, e := range entries {
switch e.Kind {
case KindReview:
reviewHash = e.Hash
case KindScan:
scanHash = e.Hash
}
}
if reviewHash == "" || scanHash == "" {
t.Fatalf("fixture: reviewHash=%q scanHash=%q", reviewHash, scanHash)
}
// Retract BOTH.
if _, err := WriteRetraction(dir, reviewHash, "the review was wrong", nil); err != nil {
t.Fatalf("retract review: %v", err)
}
if _, err := WriteRetraction(dir, scanHash, "the scan was wrong", nil); err != nil {
t.Fatalf("retract scan: %v", err)
}
db, err := LoadDir(dir)
if err != nil {
t.Fatalf("LoadDir: %v", err)
}
defer db.Close()
count := func(tbl string) int {
var n int
if err := db.QueryRow("SELECT count(*) FROM " + tbl).Scan(&n); err != nil {
t.Fatalf("count %s: %v", tbl, err)
}
return n
}
scans, audits := count("corral_scans"), count("corral_audits")
revs, finds := count("corral_reviews"), count("corral_findings")
t.Logf("after retracting both entries: corral_scans=%d corral_audits=%d corral_reviews=%d corral_findings=%d",
scans, audits, revs, finds)
// NEGATIVE CONTROL: the retracted SCAN entry is correctly gone.
if scans != 0 || audits != 0 {
t.Fatalf("control failed: the retracted scan entry is still in the view (scans=%d audits=%d)", scans, audits)
}
if revs == 0 && finds == 0 {
t.Fatal("no defect: the retracted review is gone from the view too")
}
t.Logf("DEFECT: the retracted scan left the view (0 rows) but the retracted review did not: %d review row(s), %d finding row(s)", revs, finds)
}
EOF
go test -count=1 -v -run TestZZColdRetractedReviewSurvivesInTheView ./internal/auditpush/ > zz-out.log 2>&1 || { cat zz-out.log; exit 1; }
cat zz-out.log
grep -q 'DEFECT: the retracted scan left the view' zz-out.log=== RUN TestZZColdRetractedReviewSurvivesInTheView
zz_cold_retract_test.go:69: after retracting both entries: corral_scans=0 corral_audits=0 corral_reviews=1 corral_findings=1
zz_cold_retract_test.go:79: DEFECT: the retracted scan left the view (0 rows) but the retracted review did not: 1 review row(s), 1 finding row(s)
--- PASS: TestZZColdRetractedReviewSurvivesInTheView (0.04s)
PASS
ok github.com/pdbethke/corralai/internal/auditpush 0.043sThe supplied test shows that after retracting both a scan and a review, LoadDir removes the scan rows but retains the review and finding rows. The code confirms the asymmetry: review and adjudication entries are inserted before ScanEntries is applied, while only scan entries pass through the retraction filter. PushLedgerDir similarly checks the retracted set only in its KindScan branch.
confirmed by pdbethke — real, reproduced: Retracted is honoured for scan entries only; a retracted review's rows load and push
ref ed079ca08965d0f59ec3b437cea99953b0185484e328d38dea447064fa0c3397#R3
EntryHash hashes the sparse canonical form, which prunes false, 0 and "", so a ledger entry can be edited to drop `passed: false` or a measured `kill_rate: 0` and its stored hash and Ed25519 signature still verify — falsifying LedgerEntry's claim that editing an entry breaks its signature, for exactly the recorded-zero-versus-never-measured distinction the package exists to preserve.
#!/bin/sh
set -e
cat > internal/auditpush/zz_cold_prune_test.go <<'EOF'
package auditpush
import (
"crypto/ed25519"
"encoding/hex"
"encoding/json"
"testing"
"time"
_ "github.com/marcboeker/go-duckdb/v2"
)
func TestZZColdEntryHashCannotSeeARecordedZero(t *testing.T) {
at := time.Date(2026, 9, 3, 12, 0, 0, 0, time.UTC)
failed := false
zero := 0.0
// A: the gate FAILED this scan, and the file's kill rate was MEASURED at 0.0.
a := LedgerEntry{
Format: LedgerFileFormat, Pushed: at, ScanUID: "uid", Prev: "p",
Bundle: Bundle{
Scan: ScanRow{Repo: "o/r", Commit: "deadbeef", Host: "h", Passed: &failed},
Files: []Row{{Repo: "o/r", Commit: "deadbeef", Path: "a.go", Survivors: 3, KillRate: &zero, Passed: &failed}},
},
}
// B: no threshold was set, and the kill rate was NEVER MEASURED.
b := LedgerEntry{
Format: LedgerFileFormat, Pushed: at, ScanUID: "uid", Prev: "p",
Bundle: Bundle{
Scan: ScanRow{Repo: "o/r", Commit: "deadbeef", Host: "h"},
Files: []Row{{Repo: "o/r", Commit: "deadbeef", Path: "a.go", Survivors: 3}},
},
}
ja, _ := json.Marshal(a.Bundle.Scan.Passed)
jb, _ := json.Marshal(b.Bundle.Scan.Passed)
t.Logf("A says passed=%s kill_rate=0 (measured); B says passed=%s kill_rate absent (never measured)", ja, jb)
ha, err := EntryHash(a)
if err != nil {
t.Fatal(err)
}
hb, err := EntryHash(b)
if err != nil {
t.Fatal(err)
}
t.Logf("EntryHash(A) = %s", ha)
t.Logf("EntryHash(B) = %s", hb)
if ha != hb {
t.Fatal("no defect: the two entries hash differently")
}
t.Log("DEFECT-HASH: two entries making opposite claims hash identically")
// The signature therefore transfers.
pub, priv, err := ed25519.GenerateKey(nil)
if err != nil {
t.Fatal(err)
}
raw, err := hex.DecodeString(ha)
if err != nil {
t.Fatal(err)
}
sig := ed25519.Sign(priv, raw)
rawB, err := hex.DecodeString(hb)
if err != nil {
t.Fatal(err)
}
if !ed25519.Verify(pub, rawB, sig) {
t.Fatal("the signature over A does not verify for B")
}
t.Log("DEFECT-SIG: the signature taken over entry A verifies unchanged for entry B")
// And the whole-entry canonical bytes are identical, which is what
// VerifyLedgerDir's HashOK check compares.
ca, _ := CanonicalSparseJSON(a)
cb, _ := CanonicalSparseJSON(b)
if string(ca) != string(cb) {
t.Fatal("canonical bytes differ")
}
t.Logf("DEFECT-BYTES: identical canonical entry bytes for both: %s", string(ca))
}
EOF
go test -count=1 -v -run TestZZColdEntryHashCannotSeeARecordedZero ./internal/auditpush/ > zz-out.log 2>&1 || { cat zz-out.log; exit 1; }
cat zz-out.log
grep -q 'DEFECT-HASH' zz-out.log
grep -q 'DEFECT-SIG' zz-out.log
grep -q 'DEFECT-BYTES' zz-out.log=== RUN TestZZColdEntryHashCannotSeeARecordedZero
zz_cold_prune_test.go:37: A says passed=false kill_rate=0 (measured); B says passed=null kill_rate absent (never measured)
zz_cold_prune_test.go:47: EntryHash(A) = 8f80d6982d403b1e084362a332d52c223e8edd26396ca62e679a5d092ce35677
zz_cold_prune_test.go:48: EntryHash(B) = 8f80d6982d403b1e084362a332d52c223e8edd26396ca62e679a5d092ce35677
zz_cold_prune_test.go:52: DEFECT-HASH: two entries making opposite claims hash identically
zz_cold_prune_test.go:71: DEFECT-SIG: the signature taken over entry A verifies unchanged for entry B
zz_cold_prune_test.go:80: DEFECT-BYTES: identical canonical entry bytes for both: {"bundle":{"Files":[{"Commit":"deadbeef","Path":"a.go","Repo":"o/r","Survivors":3}],"Scan":{"Commit":"deadbeef","Host":"h","Repo":"o/r"}},"format":"corral-ledger-2","prev":"p","pushed":"2026-09-03T12:00:00Z","scan_uid":"uid"}
--- PASS: TestZZColdEntryHashCannotSeeARecordedZero (0.00s)
PASS
ok github.com/pdbethke/corralai/internal/auditpush 0.008sThe supplied test demonstrates identical EntryHash values and transferable Ed25519 signatures for entries that differ between pointer-to-false versus nil and pointer-to-zero versus nil. CanonicalSparseJSON deliberately prunes false and numeric zero recursively, and EntryHash uses that representation. Although canonical.go documents the backward-compatibility rationale, LedgerEntry's stronger assertion that editing an entry breaks its signature is false for these semantically distinct edits.
confirmed by pdbethke — real, reproduced: Passed *bool nil (never measured) and false (measured) hash and verify identically under the sparse form; the entry hash must not prune
ref ed079ca08965d0f59ec3b437cea99953b0185484e328d38dea447064fa0c3397#R4
VerifyLedgerDir pairs entries[i] (sorted by Pushed at microsecond precision) with names[i] (sorted lexicographically by a file name whose timestamp has only second precision), so two entries placed inside the same second are reported under each other's file names and a chain break is attributed to the wrong file.
I traced both orderings. ReadLedgerDir sorts decoded entries by Pushed, which has microsecond precision. ledgerFileNames independently sorts filenames lexicographically, while placeEntry formats their timestamp prefix only to seconds. VerifyLedgerDir then assigns names[i] to entries[i]. For distinct entries placed in one second, suffix ordering can differ from microsecond placement ordering, so the reported filename can belong to another entry. The refusal to overwrite identical names does not impose matching lexical order on different suffixes.
confirmed by pdbethke — real, read: entries sorted by Pushed (microseconds) paired with names sorted lexically (seconds) — a chain break inside one second is named on the wrong file
ref ed079ca08965d0f59ec3b437cea99953b0185484e328d38dea447064fa0c3397#R5
PushReviewEntry writes the corral_reviews row and each corral_findings row as separate autocommitted statements with no transaction, so a failure partway through leaves a review row whose findings are absent — the exact half-landed push PushBundle wraps in one transaction to prevent.
PushReviewEntry calls insertReviewEntry directly on *sql.DB. insertReviewEntry executes the corral_reviews INSERT and then one independently autocommitted corral_findings INSERT per finding, without Begin, Commit, or rollback. Thus an error after the review-row insert can leave a partial review. In contrast, insertBundle explicitly wraps its multi-grain writes in a transaction. I found no schema or prevalidation invariant guaranteeing that all later finding statements must succeed once the review insert succeeds.
confirmed by pdbethke — real, read: PushReviewEntry is not a transaction; a half-landed review row is what PushBundle's transaction exists to prevent
ref ed079ca08965d0f59ec3b437cea99953b0185484e328d38dea447064fa0c3397#R6
Recorded so that "found nothing here" can be told apart from "never looked here".
This package's whole claim is that a number in it can be re-checked by a stranger, and the four findings below are all failures of exactly that promise at doors the package's own tests never walk through. (1) is the same defect CanonicalizeForWarehouse was written to fix, reintroduced by two columns added afterwards (finished_at, computed_at) that were never added to the canonicaliser — so `corral verify --db` fails a tamper-shaped mismatch on any real run, because production stamps both with a local-zone nanosecond time.Now(). The pinning test (cmd/corral/certify_repo_bundle_test.go:700) populates neither field, which is why nothing caught it. (2) is the derived-identity promise — "recompute scan_uid from the row you are holding" — holding for a warehouse push and failing for every ledger-directory entry, because placeEntry re-stamps Pushed after mintPush has already hashed a different timestamp into the uid; the one test that pins the property (bundle_test.go:614) only exercises the warehouse door. (3) is a retraction that takes effect for scan entries and not for review entries, in both LoadDir and PushLedgerDir, against ScanEntries' own doc that it takes effect "everywhere at once". (4) is the sparse canonical form used as a ledger entry hash: it prunes false, 0 and "", so an entry can be edited from "the gate FAILED" to "no threshold was set", or from a measured kill rate of 0.0 to "never measured", and the stored hash and Ed25519 signature still verify — the exact distinctions this package writes a hundred lines of comment defending. (5) and (6) are code-read only. The pattern across all six is the one this repo has been bitten by before: a rule enforced at the door the test opens, and missing at the door the operator uses.
The review stands in full. R1's supplied reproduction had a fixture error, but the underlying timestamp-normalization omission is visible in the writer/read-back boundary. R2–R4 are directly demonstrated by successful focused tests. R5 and R6 are supported by the relevant ordering and write paths, and I found no invariant that prevents their failure modes.